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(57) ABSTRACT 

A method of monitoring a networked computer system by 
detecting a change to a configuration of the computer 
system, using detection logic of the computer, and generat- 
ing an alert associated with any change in the configuration 
in real time. The alert is transmitted to a remote server on the 
network. In an illustrative implementation, the detection 
logic can detect (i) a change in the number of storage devices 
present in the computer system, (ii) a change in the number 
of memory modules present in the computer system, and (iii) 
a change in the number of processors present in the com- 
puter system. The configuration information may be saved 
between boot operations of the computer using a battery- 
powered latch. 

16 Claims, 4 Drawing Sheets 
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REAL-TIME ALERT MECHANISM FOR servers, such as servers 4 and 6, can communicate with each 

SIGNALING CHANGE OF SYSTEM other via network 2. The network can be local in nature, or 

CONFIGURATION can oe further connected to other systems (not shown) as 

indicated with servers 8 and 10. The construction of network 

BACKGROUND OF THE INVENTION 5 2 is also generally applicable to the Internet. 

1. Field of the Invention described ab °ve, a & y ™ computer can have many 
„ 4 . i< i components that are generally removable, and so a large 
T*e present invention generally relates to computer netW ork has a tremendous amount of such relocatable asseL 

systems, and more particularly to an inexpensive mechanism ^ of perconal computer comp0 nents, particularly those 

for real-time monitoring of computer components m net- located at unsecured workstation clients, is thus becoming a 

work clients (workstations), and generating alerts to a major industry problem . Costly components such as central 

remote network server signaling a component loss or change processing units ( C piJs), memory, hard disks and disk drives 

of system configuration. are cas ^ y retn0V ed. Frequently, the components are rein- 

2. Description of Related Art stalled in another machine within a company. In given the 
A typical structure for a conventional computer system 15 small size of many of the components, they can be hidden 

includes one or more processing units connected to a system in a pocket, briefcase or purse, and away for use in a home 

memory device (random access memory or RAM) and to system. 

various peripheral, or input/output (I/O), devices such as a Several solutions have been provided to address the issue 

display monitor, a keyboard, a graphical pointer (mouse), of component theft. Some computer desktop systems such as 

and a permanent storage device (hard disk). The system 20 those sold by International Business Machines Corp. 

memory device is used by a processing unit in carrying out (IBM— assignee of the present invention) have a tamper 

program instructions, and stores those instructions as well as detect circuit, which requires the user to enter a password to 

data values that are fed to or generated by the programs. A boot the system after the cover of the desktop unit has been 

processing unit communicates with the other components by removed. Another solution is IBM's "Alert on LAN," which 

various means, including one or more interconnects (buses), 25 creates a network alert whenever a desktop unit's cover is 

or direct memory-access channels. A computer system may removed. Neither of these solutions, however, provides 

have many additional components, such as serial and par- information about removal or addition of critical compo- 

allel ports and expansion slots for connection to, e.g., nents inside the computer system. 

printers and network adapters. Other components might i n light of the foregoing, it would be desirable to provide 

further be used in conjunction with the foregoing; for 30 a me thod of notifying a remote server when key system 

example, a display adapter might be used to control a video components are removed or added to a networked computer, 

display monitor, a memory controller can be used to access it would be further advantageous if the method did not 

the system memory, etc. require additional cabling or hardware, and if it could 

Computers can be interconnected in a variety of ways, one operate with standard network protocols and with standard 

common approach being a client-server network. A gener- 35 management applications, 

alized client-server computing network 2 is shown in FIG. SUMMARY OF THE INVENTION 
1. Network 2 has several nodes or servers 4, 6, o and 10 

which are interconnected, either directly to each other or 11 & therefore one object of the present invention to 

indirectly through one of the other servers. Each server is provide an improved method and system for monitoring 

essentially a stand-alone computer system as described 40 computer components. 

above (having one or more processors, memory devices, It is another object of the present invention to provide 
storage devices and communications devices), but has been such a method and system that can generate alerts to a 
adapted (programmed) for one primary purpose, that of remote network server in the event of a change in a corn- 
providing information to individual users at another set of puter's configuration. 

nodes, or workstation clients 12. Clients 12 can also be fully 45 It is yet another object of the present invention to provide 

functional, stand-alone computer systems (like computers, such a method and system that is generally compatible with 

or PCs), or so-called "dumber" systems adapted for limited conventional hardware and protocols, 

use with network 2 (like network computers, or NCs). A The foregoing objects are achieved in a method of moni- 

single, physical computer can act as both a server and a toring a computer system, generally comprising the steps of 

client, although this implementation occurs infrequently. 50 detecting a change to a configuration of the computer 

A client is generally a member of a class or group of system, using detection logic of the computer, and general- 
computers or computer systems that uses the services of ing an alert associated with any change in the configuration 
another class or group to which it is not related. A client also in real time. The computer system is networked, and the alert 
be thought of as a process (i.e., a program or task) that is transmitted to a remote server. In an illustrative 
requests a service which is provided by another program, 55 implementation, the detection logic can detect (i) a change 
The client process uses the requested service without having in the number of storage devices present in the computer 
to "know" any working details about the other program or system, (ii) a change in the number of memory modules 
the service itself. Based upon requests by the user, a server present in the computer system, and (iii) a change in the 
presents filtered electronic information to the user as server number of processors present in the computer system. The 
responses to the client process. 60 configuration information may be saved between boot 

The information provided by a server can be in the form operations of the computer using a battery-powered latch, 

of programs which run locally on a given client 12, or in the By detecting any change with sensitive components on 

form of data such as files that are used by other programs. networked clients, the present invention provides effective 

Users can also communicate with each other in real-time as asset control over relocatable computer components, 

well as by delayed file delivery, i.e., users connected to the 65 The above as well as additional objectives, features, and 

same server can all communicate with each other without advantages of the present invention will become apparent in 

the need for the complete network 2, and users at different the following detailed written description. 
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BRIEF DESCRIPTION OF THE DRAWINGS band bus. This approach allows the management ASIC to 

„ # ... , . t . ,. . . . . co-exist with the system's MAC and does not require 

The novel features believed char acteristic of the invention ..... . , ' , , . 7 OT „ 

, , . . ™ . . . 1C additional cabling and hardware. The management ASIC 

are set forth in the appended claims. The invention itself, ... t . & , . 4 . j-.i_.jj 

, n c j j e a runs with standard network protocols and with standard 

however, as well as a preferred mode ot use, further . .... ^ . 4 „ T Axr ~ „ , 

... , , . r ., - ... , 4 . , . j 5 management applications such as Inters LANDesK and 

objectives, and advantages thereof, will best be understood jbM's NETFINITY 

by reference to the following detailed description of an ' 

illustrative embodiment when read in conjunction with the P? connections between the ASIC/auxUiary processor 

accompanying drawings, wherein: " and th , c other s y s,em .^P° I ? e j 1 i s . are shown ln nG 2 A 

, . , central processing unit (CPU) 22 is connected to a core 24 

FIG. 1 is a diagram of a conventional computer network, 10 which indjjdes a m controUer and a peripheral com- 

mcluding interconnected servers and workstation clients; iflterconnect (pa) bridge ^ pa bridge pf0vides 

FIG. 2 is a block diagram of one embodiment of a an interconnection with a PCI bus 26 that supports several 

computer system constructed in accordance with the present PC( s]ots 2$, An industry standard architecture (ISA) bridge 

invention to provide component monitoring and alert gen- 30 ^ con nected to PCI bus 26, and provides an intercon- 

eration upon a change in system configuration; 15 nection with an ISA bus 32 that supports several ISA slots 

FIG. 3 is a schematic diagram illustrating a circuit used in 34. 

accordance with the present invention to detect a change in ^ Ethernet subsystem 36 is also connected to PCI bus 

the number of processors present in the computer system; 2 6. Ethernet subsystem 36 includes a MAC 38, an auxiliary 

FIG. 4 is a schematic diagram illustrating a circuit used in processor (ASIC) 40 connected to MAC 38 via the Mil bus 

accordance with the present invention to detect a change in 20 42, and to the physical layer 44 which is provided with an 

the number of memory modules present in the computer RJ45 connector 46. The system's power supply 48 provides 

system; an auxiliary power plane to Ethernet subsystem 36, and an 

FIG. 5 is a schematic diagram illustrating a circuit used in auxiliary power trickle to the power management feature of 

accordance with the present invention to detect a change in ISA bridge 30. 

the number of direct access storage devices (hard disks) 25 Detection logic 50 provides an input to management 

present in the computer system; and ASIC 40. Detection logic 50 is designed to monitor when a 

FIG. 6 is a schematic diagram illustrating a latch used in change to the configuration of system 20 occurs. Illustrative 

accordance with the present invention to retain information mechanisms for monitoring CPU, memory, and direct access 

regarding the configuration of the computer system. ^ storage device (DASD) are described below. 

As illustrated in FIG. 3, the CPU presence monitoring 
may be detected by snooping the SLOTOCC# pin (B101) 
that is provided on the Pentium II module. This pin is an 

With reference now to the figures, and in particular with open-drain to ground that is pulled high on the planar. When 

reference to FIG. 2, there is depicted one embodiment 20 of 35 a processor is present, the line is pulled low, so a low signal 

a computer system constructed in accordance with the on this line indicates the slot is occupied, 

present invention. Those skilled in the art will appreciate A potential problem in dual-processor machines is that a 

that the computer system's hardware may include additional terminator card, which is required if a second processor is 

components not shown in FIG. 2, or have a different not installed, will also put this line low. An optional feature 

interconnection architecture for the illustrated components 4Q 0 f the invention is a method to differentiate between pro- 

so, while the present invention may be understood with cessor and terminator card. The Pentium II provides five 

reference to FIG. 2, this reference should not be construed pins that indicate the voltage needed by the processor. A 

in a limiting sense. terminator card drives all five pins high, whereas a Pentium 

The present invention provides computer system 20 with II drives the pins to a different state that indicates a voltage 

a combination of monitoring circuits and alert generation, to 45 level. Using appropriate logic gates 52, it can be determined 

allow notification to a remote server whenever key system if the occupied slot contains a terminator or a processor. This 

components are removed or added to the system. The alerts configuration can be used for each processor slot in a 

inform network administrators or security personnel that a machine (N=l to x). Management ASIC 40 monitors the 

configuration change in critical components has occurred to CPU_present_Slot_N# line and the CPU_Term_Slot_ 

a computer system, in real time. The administrator or 50 N# line for each processor. If a change occurs, a network 

security personnel can investigate any unauthorized removal alert is generated detailing the change, 

or addition of components to machines. Management ASIC 40 also tracks which sockets contain 

The described implementation is directed to a client dual in-line memory modules (DIMMs), and detects any 

server network, but the invention may be implemented with change to either insertion or removal of DIMMs. Two 

other network architectures (e.g., peer-to-peer) so, again, 55 implementations are presented here. The first implements - 

this reference should not be construed in a limiting sense, tion does not require a change to the DIMM. A standard 

The invention may in particular be provided as an extension DIMM has 18 ground pins (pins 1, 12, 23, 32, 43, 54, 64, 68, 

to IBM's Alert on LAN. The following description is based 78, 85, 96, 107, 116, 127, 138, 148, 152 and 162). A 

on an on-board Ethernet solution, however the concept can DIMM's presence can be detected as shown in FIG. 4, by 

be applied to other communications media such as Token eo sacrificing a ground pin and placing ground-sense logic 54 

Ring, asynchronous transfer mode (ATM), or modem. in its place. 

The illustrative embodiment exploits the management The second implementation requires a change to the 

ASIC (application-specific integrated circuit) or service pro- JEDEC standard (Joint Electron Device Engineering 

cessor currently supported in IBM's PC3000PL family of Council). There are currently around ten "No Connects" 

products. The management ASIC may be designed to inter- 65 (NCs) on a DIMM. By changing one of the NCs into an 

face to a media independent interface (Mil), or have a direct open -drain to ground, a DIMMs presence can be detected in 

connection to a media access controller (MAC) via a side- the same manner as the processor SLOTOCC# signal 



DESCRIPTION OF AN ILLUSTRATIVE 
EMBODIMENT 
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described above. This pin then becomes the DIMM_ 
PRESENT_0# signal and a similar latch configuration can 
be used as shown in FIG. 3. This configuration can be used 
for each memory slot in the machine (N«l to x). The 
management ASIC monitors the DlMM_present_Slot_N# 
for each DIMM. If a change occurs, a network alert is 
generated detailing the change. 

DASD monitoring differs from the above methods 
because the pins used by the primary channel of an IDE 
controller are shared with the secondary channel. Also, the 
pins are shared between two devices (drives) on the same 
channel The CSO and CS1 pins select between the two 
drives (master and slave) on the channel. The channel is 
selected by the data strobe lines, DIOR and DIOW. Different 
IDE controllers use different configurations; the diagram 
shown in FIG. 5 is a presence detection implementation for 
use on a controller that shares the CSO and CS1 lines. The 
presence detect logic is only valid when the drives are not in 
use, which is taken into account by detection logic 50. 
During use, the presence detect logic will not interfere with 
normal operation. 

To expand device configuration checking beyond boot 
time (off and sleep states), management ASIC 40 emulates 
in hardware the functions of setup and CMOS. Management 
ASIC keeps track of the previous state of the system's 
configuration to determine if a change has occurred. As 
shown in FIG. 6, a battery-powered latch 56 is used either 
in management ASIC 40 or on the planar (motherboard) to 
latch the previous state. The previous state is compared to 
the current state and a change results in a network alert. 
When the power-on self- test (POST) completes setup, it 
resets the latch to capture the new/current configuration. 

The present invention provides several unique benefits. 
By detecting any tampering with sensitive components on 
networked clients, it provides effective asset control in a 
manner heretofore unheard of. Notification of changes in to 
a remote server occurs in real-time. As an added advantage, 
the invention allows the detection, during the manufacturing 
process, of which components are installed in a machine 
without requiring removal of the machine from the box. 

Although the invention has been described with reference 
to specific embodiments, this description is not meant to be 
construed in a limiting sense. Various modifications of the 
disclosed embodiments, as well as alternative embodiments 
of the invention, will become apparent to persons skilled in 
the art upon reference to the description of the invention. For 
example, those skilled in the art will appreciate that the 
present invention can be extended to monitor other compo- 
nents not described above, such as a modem that is con- 
nected to the computer system. It is therefore contemplated 
that such modifications can be made without departing from 
the spirit or scope of the present invention as defined in the 
appended claims. 

What is claimed is: 

1. A method of monitoring a computer system, compris- 
ing: 

detecting a change to a configuration of the computer 
system, using detection logic, wherein, when said 
change in the configuration includes a change in the 
number of processors present in the computer system, 
said detection logic completes said detecting by differ- 
entiating whether a terminator card is present in a 
processor slot; and 

generating an alert associated with the change in the 
configuration. 

2. The method of claim 1, wherein the computer system 
is networked, and further comprises the step of transmitting 
the alert to a remote server. 

3. The method of claim 1, wherein said detecting step 
occurs during real time operation of the computer system. 



4. The method of claim 1, further comprising storing the 
configuration in a latch prior to said detecting step. 

5. The method of claim 1, wherein said detecting step 
includes detecting a change in the number of storage devices 

5 present in the computer system. 

6. The method of claim 1, wherein said detecting step 
includes detecting a change in the number of memory 
modules present in the computer system. 

7. A computer system comprising: 
one or more processors; 

10 one or more storage devices connected to said one or more 
processors; 

one or more memory modules connected to said one or 

more processors; and 
means for generating an alert in response to a change to 
15 a configuration of the computer system, wherein, when 
said change in the configuration includes a change in 
the number of processors present in the computer 
system, said generating is completed in response to a 
detection logic differentiating whether a terminator 
20 card is present in a processor slot. 

8. The computer system of claim 7, wherein the computer 
system is networked, and further comprises means for 
transmitting said alert to a remote server. 

9. The computer system of claim 7, wherein said gener- 
25 ating means includes means for storing the configuration in 

a latch. 

10. The computer system of claim 7, wherein said gen- 
erating means includes means for detecting a change in the 
number of said storage devices present in the computer 

30 system. 

11. The computer system of claim 10, further comprising 
a controller for said storage devices, wherein said detecting 
means includes presence detect logic which taps off pins 
used to select a particular storage device on a channel of said 
controller. 

12. The computer system of claim 7, wherein said gen- 
erating means includes means for detecting a change in the 
number of said memory modules present in the computer 
system. 

13. The computer system of claim 12, wherein said 
40 detecting means includes ground-sense logic attached to a 

ground pin of each memory module. 

14. The computer system of claim 7, wherein said gen- 
erating means includes an auxiliary processor. 

15. The computer system of claim 14, wherein said 
45 auxiliary processor is an application-specific integrated cir- 
cuit. 

16. A computer network comprising: 
at least one server; and 

at least one client connected to said server, said client 
50 having: 

a plurality of processors; 

a plurality of storage devices connected to said proces- 
sors; 

a plurality of memory modules connected to said 
55 processors, 

first means for generating an alert in response to a 

change to a configuration of the client; and 
second means for transmitting said alert to said server, 
wherein said generating means includes means for 
60 detecting a change in (i) the number of said proces- 

sors present in the client by differentiating whether a 
terminator card is present in a processor slot, (ii) the 
number of said storage devices present in the client, 
and (iii) the number of said memory modules present 
65 in the client. 

* * * * * 
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